List secret scanning alerts for an organization
Lists secret scanning alerts for eligible repositories in an organization, from newest to oldest.
The authenticated user must be an administrator or security manager for the organization to use this endpoint.
OAuth app tokens and personal access tokens (classic) need the repo or security_events scope to use this endpoint. If this endpoint is only used with public repositories, the token can use the public_repo scope instead.
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “ Path Parameters ”The organization name. The name is not case sensitive.
Query Parameters
Section titled “ Query Parameters ”Set to open or resolved to only list secret scanning alerts in a specific state.
A comma-separated list of secret types to return. All default secret patterns are returned. To return generic patterns, pass the token name(s) in the parameter. See “Supported secret scanning patterns” for a complete list of secret types.
A comma-separated list of secret types to exclude from the results. All default secret patterns are returned except those matching the specified types. Cannot be combined with the secret_type parameter. See “Supported secret scanning patterns” for a complete list of secret types.
A comma-separated list of provider slugs to exclude from the results.
Provider slugs use lowercase with underscores (e.g., github_secret_scanning, clojars).
You can find the provider slug in the provider_slug field of each alert.
Cannot be combined with the providers parameter.
A comma-separated list of provider slugs to filter by.
Provider slugs use lowercase with underscores (e.g., github_secret_scanning, clojars).
You can find the provider slug in the provider_slug field of each alert.
Cannot be combined with the exclude_providers parameter.
A comma-separated list of resolutions. Only secret scanning alerts with one of these resolutions are listed. Valid resolutions are false_positive, wont_fix, revoked, pattern_edited, pattern_deleted or used_in_tests.
Filters alerts by assignee. Use * to get all assigned alerts, none to get all unassigned alerts, or a GitHub username to get alerts assigned to a specific user.
Examples
Filter for alerts assigned to the user "octocat"
octocatFilter for all assigned alerts
*Filter for all unassigned alerts
noneThe property to sort the results by. created means when the alert was created. updated means when the alert was updated or resolved.
The direction to sort the results by.
The page number of the results to fetch. For more information, see “Using pagination in the REST API.”
The number of results per page (max 100). For more information, see “Using pagination in the REST API.”
A cursor, as given in the Link header. If specified, the query only searches for events before this cursor. To receive an initial cursor on your first request, include an empty “before” query string.
A cursor, as given in the Link header. If specified, the query only searches for events after this cursor. To receive an initial cursor on your first request, include an empty “after” query string.
A comma-separated list of validities that, when present, will return alerts that match the validities in this list. Valid options are active, inactive, and unknown.
A boolean value representing whether or not to filter alerts by the publicly-leaked tag being present.
A boolean value representing whether or not to filter alerts by the multi-repo tag being present.
A boolean value representing whether or not to hide literal secrets in the results.
A boolean value (true or false) indicating whether to filter alerts by their push protection bypass status. When set to true, only alerts that were created because a push protection rule was bypassed will be returned. When set to false, only alerts that were not caused by a push protection bypass will be returned.
A comma-separated list of metadata fields to filter alerts by. Only alerts that have all of the
specified metadata fields attached will be returned. Possible values are: owner-email, owner-id,
owner-name, secret-id, secret-name, secret-issued-date, secret-expiration-date, organization-name,
organization-id, last-used-date, and has-organization-access.
Filters alerts to only those whose attached owner_email metadata field matches the
provided value. The value must be the lowercase hex-encoded SHA-256 hash of the email
address to match (for example, the SHA-256 of user@example.com). Only alerts that
have an owner_email metadata value whose SHA-256 hash equals this parameter are
returned.
Responses
Section titled “ Responses ”Response
object
The security alert number.
The time that the alert was created in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
The time that the alert was last updated in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
The REST API URL of the alert resource.
The GitHub URL of the alert resource.
The REST API URL of the code locations for this alert.
Sets the state of the secret scanning alert. You must provide resolution when you set the state to resolved.
Required when the state is resolved. The reason for resolving the alert.
The time that the alert was resolved in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
A GitHub user.
object
The type of secret that secret scanning detected.
User-friendly name for the detected secret, matching the secret_type.
For a list of built-in patterns, see “Supported secret scanning patterns.”
The provider of the secret that was detected.
The slug identifier for the provider of the secret that was detected. Use this value for filtering by provider with the providers or exclude_providers parameters.
The secret that was detected.
A GitHub repository.
object
A unique identifier of the repository.
The GraphQL identifier of the repository.
The name of the repository.
The full, globally unique, name of the repository.
A GitHub user.
object
Whether the repository is private.
The URL to view the repository on GitHub.com.
The repository description.
Whether the repository is a fork.
The URL to get more information about the repository from the GitHub API.
A template for the API URL to download the repository as an archive.
A template for the API URL to list the available assignees for issues in the repository.
A template for the API URL to create or retrieve a raw Git blob in the repository.
A template for the API URL to get information about branches in the repository.
A template for the API URL to get information about collaborators of the repository.
A template for the API URL to get information about comments on the repository.
A template for the API URL to get information about commits on the repository.
A template for the API URL to compare two commits or refs.
A template for the API URL to get the contents of the repository.
A template for the API URL to list the contributors to the repository.
The API URL to list the deployments of the repository.
The API URL to list the downloads on the repository.
The API URL to list the events of the repository.
The API URL to list the forks of the repository.
A template for the API URL to get information about Git commits of the repository.
A template for the API URL to get information about Git refs of the repository.
A template for the API URL to get information about Git tags of the repository.
A template for the API URL to get information about issue comments on the repository.
A template for the API URL to get information about issue events on the repository.
A template for the API URL to get information about issues on the repository.
A template for the API URL to get information about deploy keys on the repository.
A template for the API URL to get information about labels of the repository.
The API URL to get information about the languages of the repository.
The API URL to merge branches in the repository.
A template for the API URL to get information about milestones of the repository.
A template for the API URL to get information about notifications on the repository.
A template for the API URL to get information about pull requests on the repository.
A template for the API URL to get information about releases on the repository.
The API URL to list the stargazers on the repository.
A template for the API URL to get information about statuses of a commit.
The API URL to list the subscribers on the repository.
The API URL to subscribe to notifications for this repository.
The API URL to get information about tags on the repository.
The API URL to list the teams on the repository.
A template for the API URL to create or retrieve a raw Git tree of the repository.
The API URL to list the hooks on the repository.
Whether push protection was bypassed for the detected secret.
A GitHub user.
object
The time that push protection was bypassed in ISO 8601 format: YYYY-MM-DDTHH:MM:SSZ.
A GitHub user.
object
An optional comment when reviewing a push protection bypass.
An optional comment when requesting a push protection bypass.
The URL to a push protection bypass request.
The comment that was optionally added when this alert was closed
The token status as of the latest validity check.
Whether the secret was publicly leaked.
Whether the detected secret was found in multiple repositories in the same organization or enterprise.
A boolean value representing whether or not alert is base64 encoded
Represents a ‘commit’ secret scanning location type. This location type shows that a secret was detected inside a commit to a repository.
object
The file path in the repository
Line number at which the secret starts in the file
Line number at which the secret ends in the file
The column at which the secret starts within the start line when the file is interpreted as 8BIT ASCII
The column at which the secret ends within the end line when the file is interpreted as 8BIT ASCII
SHA-1 hash ID of the associated blob
The API URL to get the associated blob resource
SHA-1 hash ID of the associated commit
The API URL to get the associated commit resource
The GitHub URL to get the associated commit resource.
Represents a ‘wiki_commit’ secret scanning location type. This location type shows that a secret was detected inside a commit to a repository wiki.
object
The file path of the wiki page
Line number at which the secret starts in the file
Line number at which the secret ends in the file
The column at which the secret starts within the start line when the file is interpreted as 8-bit ASCII.
The column at which the secret ends within the end line when the file is interpreted as 8-bit ASCII.
SHA-1 hash ID of the associated blob
The GitHub URL to get the associated wiki page
SHA-1 hash ID of the associated commit
The GitHub URL to get the associated wiki commit
Represents an ‘issue_title’ secret scanning location type. This location type shows that a secret was detected in the title of an issue.
object
The API URL to get the issue where the secret was detected.
The GitHub URL for the issue where the secret was detected.
Represents an ‘issue_body’ secret scanning location type. This location type shows that a secret was detected in the body of an issue.
object
The API URL to get the issue where the secret was detected.
The GitHub URL for the issue where the secret was detected.
Represents an ‘issue_comment’ secret scanning location type. This location type shows that a secret was detected in a comment on an issue.
object
The API URL to get the issue comment where the secret was detected.
The GitHub URL for the issue comment where the secret was detected.
Represents a ‘discussion_title’ secret scanning location type. This location type shows that a secret was detected in the title of a discussion.
object
The URL to the discussion where the secret was detected.
Represents a ‘discussion_body’ secret scanning location type. This location type shows that a secret was detected in the body of a discussion.
object
The URL to the discussion where the secret was detected.
Represents a ‘discussion_comment’ secret scanning location type. This location type shows that a secret was detected in a comment on a discussion.
object
The API URL to get the discussion comment where the secret was detected.
Represents a ‘pull_request_title’ secret scanning location type. This location type shows that a secret was detected in the title of a pull request.
object
The API URL to get the pull request where the secret was detected.
The GitHub URL for the pull request where the secret was detected.
Represents a ‘pull_request_body’ secret scanning location type. This location type shows that a secret was detected in the body of a pull request.
object
The API URL to get the pull request where the secret was detected.
The GitHub URL for the pull request where the secret was detected.
Represents a ‘pull_request_comment’ secret scanning location type. This location type shows that a secret was detected in a comment on a pull request.
object
The API URL to get the pull request comment where the secret was detected.
The GitHub URL for the pull request comment where the secret was detected.
Represents a ‘pull_request_review’ secret scanning location type. This location type shows that a secret was detected in a review on a pull request.
object
The API URL to get the pull request review where the secret was detected.
The GitHub URL for the pull request review where the secret was detected.
Represents a ‘pull_request_review_comment’ secret scanning location type. This location type shows that a secret was detected in a review comment on a pull request.
object
The API URL to get the pull request review comment where the secret was detected.
The GitHub URL for the pull request review comment where the secret was detected.
A boolean value representing whether or not the token in the alert was detected in more than one location.
A GitHub user.
object
An optional comment from the closure request author.
An optional comment from the closure request reviewer.
A GitHub user.
object
Examples
[ { "number": 2, "created_at": "2020-11-06T18:48:51Z", "url": "https://api.github.com/repos/owner/private-repo/secret-scanning/alerts/2", "html_url": "https://github.com/owner/private-repo/security/secret-scanning/2", "locations_url": "https://api.github.com/repos/owner/private-repo/secret-scanning/alerts/2/locations", "state": "resolved", "resolution": "false_positive", "resolved_at": "2020-11-07T02:47:13Z", "resolved_by": { "login": "monalisa", "id": 2, "node_id": "MDQ6VXNlcjI=", "avatar_url": "https://alambic.github.com/avatars/u/2?", "gravatar_id": "", "url": "https://api.github.com/users/monalisa", "html_url": "https://github.com/monalisa", "followers_url": "https://api.github.com/users/monalisa/followers", "following_url": "https://api.github.com/users/monalisa/following{/other_user}", "gists_url": "https://api.github.com/users/monalisa/gists{/gist_id}", "starred_url": "https://api.github.com/users/monalisa/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/monalisa/subscriptions", "organizations_url": "https://api.github.com/users/monalisa/orgs", "repos_url": "https://api.github.com/users/monalisa/repos", "events_url": "https://api.github.com/users/monalisa/events{/privacy}", "received_events_url": "https://api.github.com/users/monalisa/received_events", "type": "User", "site_admin": true }, "secret_type": "adafruit_io_key", "secret_type_display_name": "Adafruit IO Key", "secret": "aio_XXXXXXXXXXXXXXXXXXXXXXXXXXXX", "repository": { "id": 1296269, "node_id": "MDEwOlJlcG9zaXRvcnkxMjk2MjY5", "name": "Hello-World", "full_name": "octocat/Hello-World", "owner": { "login": "octocat", "id": 1, "node_id": "MDQ6VXNlcjE=", "avatar_url": "https://github.com/images/error/octocat_happy.gif", "gravatar_id": "", "url": "https://api.github.com/users/octocat", "html_url": "https://github.com/octocat", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "organizations_url": "https://api.github.com/users/octocat/orgs", "repos_url": "https://api.github.com/users/octocat/repos", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "received_events_url": "https://api.github.com/users/octocat/received_events", "type": "User", "site_admin": false }, "private": false, "html_url": "https://github.com/octocat/Hello-World", "description": "This your first repo!", "fork": false, "url": "https://api.github.com/repos/octocat/Hello-World", "archive_url": "https://api.github.com/repos/octocat/Hello-World/{archive_format}{/ref}", "assignees_url": "https://api.github.com/repos/octocat/Hello-World/assignees{/user}", "blobs_url": "https://api.github.com/repos/octocat/Hello-World/git/blobs{/sha}", "branches_url": "https://api.github.com/repos/octocat/Hello-World/branches{/branch}", "collaborators_url": "https://api.github.com/repos/octocat/Hello-World/collaborators{/collaborator}", "comments_url": "https://api.github.com/repos/octocat/Hello-World/comments{/number}", "commits_url": "https://api.github.com/repos/octocat/Hello-World/commits{/sha}", "compare_url": "https://api.github.com/repos/octocat/Hello-World/compare/{base}...{head}", "contents_url": "https://api.github.com/repos/octocat/Hello-World/contents/{+path}", "contributors_url": "https://api.github.com/repos/octocat/Hello-World/contributors", "deployments_url": "https://api.github.com/repos/octocat/Hello-World/deployments", "downloads_url": "https://api.github.com/repos/octocat/Hello-World/downloads", "events_url": "https://api.github.com/repos/octocat/Hello-World/events", "forks_url": "https://api.github.com/repos/octocat/Hello-World/forks", "git_commits_url": "https://api.github.com/repos/octocat/Hello-World/git/commits{/sha}", "git_refs_url": "https://api.github.com/repos/octocat/Hello-World/git/refs{/sha}", "git_tags_url": "https://api.github.com/repos/octocat/Hello-World/git/tags{/sha}", "issue_comment_url": "https://api.github.com/repos/octocat/Hello-World/issues/comments{/number}", "issue_events_url": "https://api.github.com/repos/octocat/Hello-World/issues/events{/number}", "issues_url": "https://api.github.com/repos/octocat/Hello-World/issues{/number}", "keys_url": "https://api.github.com/repos/octocat/Hello-World/keys{/key_id}", "labels_url": "https://api.github.com/repos/octocat/Hello-World/labels{/name}", "languages_url": "https://api.github.com/repos/octocat/Hello-World/languages", "merges_url": "https://api.github.com/repos/octocat/Hello-World/merges", "milestones_url": "https://api.github.com/repos/octocat/Hello-World/milestones{/number}", "notifications_url": "https://api.github.com/repos/octocat/Hello-World/notifications{?since,all,participating}", "pulls_url": "https://api.github.com/repos/octocat/Hello-World/pulls{/number}", "releases_url": "https://api.github.com/repos/octocat/Hello-World/releases{/id}", "stargazers_url": "https://api.github.com/repos/octocat/Hello-World/stargazers", "statuses_url": "https://api.github.com/repos/octocat/Hello-World/statuses/{sha}", "subscribers_url": "https://api.github.com/repos/octocat/Hello-World/subscribers", "subscription_url": "https://api.github.com/repos/octocat/Hello-World/subscription", "tags_url": "https://api.github.com/repos/octocat/Hello-World/tags", "teams_url": "https://api.github.com/repos/octocat/Hello-World/teams", "trees_url": "https://api.github.com/repos/octocat/Hello-World/git/trees{/sha}", "hooks_url": "https://api.github.com/repos/octocat/Hello-World/hooks" }, "push_protection_bypassed_by": { "login": "monalisa", "id": 2, "node_id": "MDQ6VXNlcjI=", "avatar_url": "https://alambic.github.com/avatars/u/2?", "gravatar_id": "", "url": "https://api.github.com/users/monalisa", "html_url": "https://github.com/monalisa", "followers_url": "https://api.github.com/users/monalisa/followers", "following_url": "https://api.github.com/users/monalisa/following{/other_user}", "gists_url": "https://api.github.com/users/monalisa/gists{/gist_id}", "starred_url": "https://api.github.com/users/monalisa/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/monalisa/subscriptions", "organizations_url": "https://api.github.com/users/monalisa/orgs", "repos_url": "https://api.github.com/users/monalisa/repos", "events_url": "https://api.github.com/users/monalisa/events{/privacy}", "received_events_url": "https://api.github.com/users/monalisa/received_events", "type": "User", "site_admin": true }, "push_protection_bypassed": true, "push_protection_bypassed_at": "2020-11-06T21:48:51Z", "push_protection_bypass_request_reviewer": { "login": "octocat", "id": 3, "node_id": "MDQ6VXNlcjI=", "avatar_url": "https://alambic.github.com/avatars/u/3?", "gravatar_id": "", "url": "https://api.github.com/users/octocat", "html_url": "https://github.com/octocat", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "organizations_url": "https://api.github.com/users/octocat/orgs", "repos_url": "https://api.github.com/users/octocat/repos", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "received_events_url": "https://api.github.com/users/octocat/received_events", "type": "User", "site_admin": true }, "push_protection_bypass_request_reviewer_comment": "Example response", "push_protection_bypass_request_comment": "Example comment", "push_protection_bypass_request_html_url": "https://github.com/owner/repo/secret_scanning_exemptions/1", "resolution_comment": "Example comment", "validity": "active", "publicly_leaked": false, "multi_repo": false, "is_base64_encoded": false, "first_location_detected": { "path": "/example/secrets.txt", "start_line": 1, "end_line": 1, "start_column": 1, "end_column": 64, "blob_sha": "af5626b4a114abcb82d63db7c8082c3c4756e51b", "blob_url": "https://api.github.com/repos/octocat/hello-world/git/blobs/af5626b4a114abcb82d63db7c8082c3c4756e51b", "commit_sha": "f14d7debf9775f957cf4f1e8176da0786431f72b", "commit_url": "https://api.github.com/repos/octocat/hello-world/git/commits/f14d7debf9775f957cf4f1e8176da0786431f72b" }, "has_more_locations": true, "assigned_to": { "login": "octocat", "id": 1, "node_id": "MDQ6VXNlcjE=", "avatar_url": "https://github.com/images/error/octocat_happy.gif", "gravatar_id": "", "url": "https://api.github.com/users/octocat", "html_url": "https://github.com/octocat", "followers_url": "https://api.github.com/users/octocat/followers", "following_url": "https://api.github.com/users/octocat/following{/other_user}", "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}", "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/octocat/subscriptions", "organizations_url": "https://api.github.com/users/octocat/orgs", "repos_url": "https://api.github.com/users/octocat/repos", "events_url": "https://api.github.com/users/octocat/events{/privacy}", "received_events_url": "https://api.github.com/users/octocat/received_events", "type": "User", "site_admin": false } }]Headers
Section titled “ Headers ”Example
<https://api.github.com/resource?page=2>; rel="next", <https://api.github.com/resource?page=5>; rel="last"Resource not found
Basic Error
object
Example generated
{ "message": "example", "documentation_url": "example", "url": "example", "status": "example"}Service unavailable
object
Example generated
{ "code": "example", "message": "example", "documentation_url": "example"}